Repository navigation
Fix final Server 1.6.554 Go component security findings - #382
Merged
Merged
Conversation
chen21019
marked this pull request as ready for review
October 29, 2026 10:59
chen21019
force-pushed
the
fix/server554-component-security
branch
from
October 29, 2026 11:04
d96a0fa to
51d968c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The release image scan found fixable Go vulnerabilities in the secret-delivery API and Docker Machine binaries. Consume Secret Delivery API v0.3.4 and Machine Driver Bundle v0.16.6 using their verified producer revisions, release archive hashes and executable hashes.
Preserve the existing narrow OpenPGP code-absence decision for the two updated Machine binaries by binding it to x/crypto v0.58.0 and their exact bytes. Unknown targets, changed binaries and unreviewed versions remain rejected. Other component and Ubuntu security policy scopes are unchanged.
Validation:
The release stays v1.6.554 because the earlier publisher stopped before publishing an image or release. Existing v1.6.553 is preserved for rollback. Mounted-data persistence is verified separately during deployment with a random marker that cannot be reconstructed from the container environment.